• fix(cursor-daemon): widen safeResolve type for daemonToken (#1385)
• fix(cursor-daemon): auto-generate token + expose for callers (#1384)
• fix(browser): track explicit devtools_port from config (#1383)
• fix(browser): avoid implicit explicit devtools port for config attach (#1369)
• docs(docker): avoid exposing dashboard password in examples (#1382)
• docs(docker): harden remote token migration staging (#1381)
• fix: create explicit CODEX_HOME with secure permissions (#1380)
• fix(proxy): honor backpressure in cliproxy local streaming (#1379)
• fix(claude-extension): enforce private permissions for settings writes (#1378)
• fix(cursor): enforce auth token for anthropic daemon route (#1377)
• fix: narrow legacy GLMT base URL normalization (#1376)
• fix(codex): cap buffered upstream error response size (#1375)
• fix(ci): qualify docker release checkout refs (#1374)
• fix(cursor): authenticate local daemon health/runtime traffic (#1373)
• fix(dashboard): clear local control-panel management key (#1372)